Malicious npm Releases Targeted Crypto Transactions, Reaching 10% of Cloud Environments
Summary
A social-engineering attack on an npm maintainer’s account led to malicious package releases that could alter browser-based crypto transactions. Wiz reported the injected code in at least 10% of cloud environments; the package list was still evolving.
Key points
- The actor gained control of maintainer Qix’s npm account through social engineering and published malicious releases, including debug and chalk. The releases were removed after roughly two hours.
- Malicious code in frontend bundles intercepted network and wallet APIs, changing recipients, spender addresses, or token approvals before users signed transactions.
- Packages in the DuckDB ecosystem were also reported affected; the article says the affected list was evolving.
- Wiz reported that malicious code was present in bundles or assets in at least 10% of cloud environments. It said successful cryptocurrency theft was reportedly minimal.
- Exposure depends on whether affected versions were resolved, bundled, and served to browsers; server-only Node.js use was described as lower risk.
- The article recommends checking lockfiles, registries, and built assets; blocking affected versions; rebuilding from clean caches; and invalidating affected CDN assets.
- It also recommends reviewing signing-flow telemetry and on-chain activity, and keeping package blocklists current.
Article Details
- Event Type
- npm supply-chain compromise involving malicious releases of popular packages, including debug and chalk
- Impact
- Malicious package versions could embed browser-side code in frontend builds that rewrites cryptocurrency recipients, spender addresses, and approvals before signing, potentially diverting transactions to attacker-controlled wallets. Wiz reports the malicious code reached at least 10% of cloud environments; reported cryptocurrency theft was minimal. The affected releases were removed from npm within hours, but the campaign was reported as still unfolding and the affected package list evolving.
MITRE ATT&CK
T1059.007 · JavaScriptObfuscated JavaScript in affected releases executes in users' browsers and intercepts network and wallet APIs.T1195.002 · Compromise Software Supply ChainThe threat actor compromised an npm maintainer account and published malicious releases of software packages.T1566 · PhishingThe threat actor reportedly gained control of the maintainer's npm account through social engineering; the specific phishing method is not described.
People
Vendors
Products
Chalkthen published several malicious releases of numerous highly popular npm packages, including debug and chalk. Following the discovery of this attack, at around 11AM EST the maintainer acknowledged the compromise andDebugthreat actor then published several malicious releases of numerous highly popular npm packages, including debug and chalk. Following the discovery of this attack, at around 11AM EST the maintainer acknowledged theDuckDBthis campaign is still unfolding and its scope goes beyond Qix’s packages, also including packages in the DuckDB ecosystem. Organizations should therefore treat the affected list as evolving, and assume that maliciousnpmOn September 8th, 2025, at around 9AM EST, a threat actor had managed to gain control of the npm account of well-known developer Qix via social engineering. The threat actor then published several malicious releases of